CVE-2025-62374: Prototype Pollution Vulnerability in Parse Package
Summary
CVE-2025-62374: Parse Javascript SDK vulnerable to prototype pollution in Parse.Object and internal APIs. Affects parse versions < 7.0.0. Fixed in 7.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Parse package is a popular JavaScript SDK that allows developers to build applications using the Parse Server. It provides various functionalities, including data storage, user management, and real-time notifications. However, it has been found to be vulnerable to prototype pollution, which can lead to severe security issues if exploited.
Vulnerability Detail
This vulnerability arises from the ability to inject malicious payloads into various APIs of the Parse SDK, specifically affecting Parse.Object and internal APIs. Attackers can exploit this flaw to execute arbitrary code remotely, leading to potential data breaches or unauthorized access to sensitive information. The affected methods include ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, and internal methods such as ObjectStateMutations and encode/decode.
How To Fix
Latest published version: 8.6.2 as of 23 Oct 2026
npm install parse@8.6.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.0
This is the first release that contains the fix.
npm install parse@7.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the affected methods until you can update to the patched version. Ensure that any user input is properly sanitized to prevent injection attacks.
Conclusion
The CVE-2025-62374 vulnerability in the Parse package poses a significant risk due to its potential for prototype pollution. It is crucial for developers using this SDK to update to the patched version to mitigate the risk of exploitation.
See every vulnerability recorded for parse →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify an object's prototype, potentially leading to unexpected behavior and security issues in applications.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
If exploited, this vulnerability can allow attackers to execute arbitrary code, leading to data breaches, unauthorized access, and potential compromise of the entire application.
Yes, not updating the package exposes your application to potential attacks that could exploit this vulnerability, putting your data and users at risk.
Additional details can be found in the official advisory on GitHub and the Parse community security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
